CVE-2026-49068: WordPress Coupon Affiliates plugin <= 7.8.1 - Sensitive Data Exposure vulnerability

Synopsis

This is a sensitive data exposure vulnerability in the Coupon Affiliates WordPress plugin (versions 7.8.1 and below), developed by RelyWP. It is reachable over the network with no authentication required, meaning any internet-connected attacker can trigger it without holding any account or credential. Successful exploitation gives an attacker read access to subscriber-level sensitive data stored or processed by the plugin. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP/HTTPS from any internet-connected location.

• AuthenticationNot required

  No account, session token, or credential of any kind is needed to trigger the vulnerability.

• Victim interactionNot required

  The attack is entirely server-side and requires no action from a logged-in user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and places no preconditions on memory layout, timing, or environmental configuration.

Blast Radius

• An attacker reads sensitive subscriber data exposed by the plugin, which may include personal details, affiliate tracking records, or account metadata stored in the WordPress database.
• Confidentiality impact is rated HIGH, indicating the full scope of accessible subscriber data can be extracted rather than only partial or indirect disclosure.
• No integrity or availability impact is indicated, so the attacker cannot modify records or disrupt service through this vector alone.
• Exposed subscriber data can be harvested at scale without rate-limiting from the vulnerability itself, enabling bulk collection across all affected sites.